s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1981965 high

📛 Threat Title

Akira Stealer: SHA1 hash of a malware sample (payload) 6af54884b79e3677a956eb4e21b4a98319b6b895

Category: Akira Stealer Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-10-23 13:39:11 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha1 6af54884b79e3677a956eb4e21b4a98319b6b895 VT 42 / 75

IOC database

Type
hash_sha1
Value
6af54884b79e3677a956eb4e21b4a98319b6b895
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA1 hash of a malware sample (payload) attributed to Akira Stealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 42 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win.GoCrypt.R802498
Alibaba malicious TrojanPSW:Win32/Kryptik.e58afaf2
alibabacloud malicious Trojan[stealer]:Multi/Agent.gyf
ALYac malicious Trojan.GenericKD.81911521
Antiy-AVL malicious Trojan/Win32.Kryptik
Arcabit malicious Trojan.Generic.D4E1DEE1
Avast malicious Win64:Evo-gen [Trj]
AVG malicious Win64:Evo-gen [Trj]
Avira malicious TR/W64.Evo
BitDefender malicious Trojan.GenericKD.81911521
Bkav malicious W32.Malware.57F91E47
CrowdStrike malicious win/malicious_confidence_60% (W)
CTX malicious exe.trojan.wingo
Cylance malicious Unsafe
Cynet malicious Malicious (score: 99)
DrWeb malicious Trojan.Siggen36.45142
Elastic malicious malicious (high confidence)
Emsisoft malicious Trojan.GenericKD.81911521 (B)
ESET-NOD32 malicious WinGo/Kryptik.XL trojan
F-Secure malicious Trojan.TR/W64.Evo
Fortinet malicious W64/Vidar.YI!tr
GData malicious Win32.Trojan-Stealer.CredStealer.CC5OEF
Google malicious Detected
Gridinsoft malicious Trojan.Win64.Kryptik.cl
Ikarus malicious Trojan.WinGo.Krypt
Kaspersky malicious Trojan-PSW.Win64.BroPass.ikr
Kingsoft malicious Win64.Trojan-PSW.BroPass.ikr
Lionic malicious Trojan.Win32.AokigaharaStealer.4!c
Malwarebytes malicious Spyware.Vidar
McAfeeD malicious ti!64F8A2E463E9
Microsoft malicious Trojan:Win32/Egairtigado!rfn
MicroWorld-eScan malicious Trojan.GenericKD.81911521
Paloalto malicious generic.ml
Rising malicious Trojan.Kryptik!8.8 (TFE:29:P2ZuuPCwa7H)
Sangfor malicious Trojan.Win32.Agent.Vyee
Sophos malicious Mal/Generic-S
Symantec malicious ML.Attribute.HighConfidence
Tencent malicious Win32.Trojan.FalseSign.Qgil
TrellixENS malicious Artemis!2A99E44E9284
TrendMicro-HouseCall malicious Trojan.Win64.WINGO.TL0101JN26YK
Varist malicious W64/WinGo.J.gen!Eldorado
VIPRE malicious Trojan.GenericKD.81911521

Details From VirusTotal

Basic Properties
MD52a99e44e9284d40657818571464ea5b0
SHA-16af54884b79e3677a956eb4e21b4a98319b6b895
SHA-25664f8a2e463e90c05bfef709f4747224b39d0b69461a6fe646f1da9d4f509df9e
VHash036086656d15551d15545az2e!z
SSDEEP49152:fB62IcqjPewhKXVB1sCVG06+KrsHQfsIlqlfe0yj:fkGlrKYHQUNxeB
TLSHT120E55B17BF9189B9C096E730CAB65552B6B5BC4C073233D72EA0B6342F723C45AB6B44
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32+ executable (GUI) x86-64, for MS Windows
File size2.9 MB
History
First seen on VirusTotal2026-10-22 10:06 UTC
Last submission2026-10-23 10:14 UTC
Last analysis2026-10-23 20:16 UTC
Last modified on VirusTotal2026-10-23 22:21 UTC
Known Names
  • glaicer.exe
  • rul2gf.exe
  • 64f8a2e463e90c05bfef709f4747224b39d0b69461a6fe646f1da9d4f509df9e.exe
  • bxjnlur9.exe
  • t6i5y7ka7.exe

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Akira Stealer. Confidence: 95. First seen: 2026-10-23 13:39:11 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | Akira
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as Akira .

  • MalwareBazaar | akira - abuse.ch
    web:bazaar.abuse.ch

    Malware samples associated with tag akira MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with akira . Database Entry

  • malware-analysis-lab/analyses/Akira-Ransomware at main - GitHub
    web:github.com

    Executive Summary This report documents the static analysis of a confirmed Akira ransomware sample obtained from MalwareBazaar. Akira is a Ransomware- as -a-Service (RaaS) operation that emerged in March 2023 and rapidly became one of the most prolific ransomware groups globally, targeting primarily small-to-medium enterprises across healthcare, education, finance, and manufacturing sectors. The ...

  • Malware/Akira/Akira_samples.txt at main · rivitna/Malware
    web:github.com

    Contribute to rivitna/ Malware development by creating an account on GitHub.

  • Malware Hash Lookup — Check MD5, SHA-1 & SHA-256
    web:imalware.com

    It compares a file's fingerprint (its MD5, SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .

  • Akira Stealer malware sample 73de504b1d7c769d… | isMalicious
    web:ismalicious.com

    Akira Stealer malware sample 73de504b1d7c769d4d6bacd193b06f90aaf2fadb0fb7d2065eb02760d7074fde: threat listings, file type, antivirus signatures, public reports and its MD5, SHA-1 and SHA-256, from the isMalicious threat intelligence dataset.

  • Akira Stealer malware sample f63453a6624e5565… | isMalicious
    web:ismalicious.com

    Akira Stealer sample f63453a6624e55650957b76802c76c24678821a145694e8dc86b61ab19681e0b: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.

  • ThreatFox | 03f15483f39c480ebdcfe20891d6601c3800267c
    web:threatfox.abuse.ch

    Akira Stealer IOC: 03f15483f39c480ebdcfe20891d6601c3800267c ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...

  • ThreatFox | 21ef070e39f651118a804882374dc2dfa3e38666
    web:threatfox.abuse.ch

    Akira Stealer IOC: 21ef070e39f651118a804882374dc2dfa3e38666 ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...

  • Akira Stealer : An Undetected Python Based Info-stealer
    web:www.cyfirma.com

    Akira is an information stealing malware being offered on a dedicated website as MaaS ( malware - as -a-service) with the tag " Akira Undetector". The web platform provides an interface to generate a new stealer binary with instructions to use the malware , leveraging the Telegram channel to provide updates and command-and-control functionality.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.